Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to connect to a remote device (which connect to my server on port 31200 via TCP) and while troubleshooting with ngrep I'm getting the following:

T(6) 2012/02/21 00:26:25.817525 9.8.7.6:37400 -> 1.2.3.4:31200 [S]

T(6) 2012/02/21 00:26:25.817556 1.2.3.4:31200 -> 9.8.7.6:37400 [AR]

Does anyone know what the [S] and [AR] stand for or where I can find further info, can't find anything after an hour of searching (my C is poor so can't look into the source of ngrep to figure things out)! Also would be good to know what the (6) stands for, I've read it's the subprotocol but what does it correspond to?

Thanks

share|improve this question

1 Answer 1

up vote 0 down vote accepted

According to the ngrep source, the T denotes TCP, and the (6) is the unsigned decimal representation of the protocol itself (read from the packet) - so the notations are equivalent. The available protocols are:

  • T(6) - TCP
  • U(17) UDP
  • I(1) - ICMP
  • I(58) - ICMPv6
  • G(2) - IGMP
  • ? (unknown)

There is a lot more, but those are the only ones put out by ngrep.

The possibilities for the TCP flags are:

  • ACK [A]
  • SYN [S]
  • RST [R]
  • FIN [F]
  • URG [U]
  • PUSH [P]
  • ECE [E]
  • CWR [C]
share|improve this answer
    
Sorted, much appreciated! –  kokonut Feb 22 '12 at 9:39
    
It's just amazing that this isn't documented anywhere... –  Mei Feb 22 '12 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.